Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Per IP traffic shaping–share bandwith evenly between IP addresses??

    Scheduled Pinned Locked Moved Traffic Shaping
    172 Posts 75 Posters 137.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      If anyone has any tips regarding limiting connections please let me know and thanks again foxale08!

      Maximum state entries per host on the main LAN pass rule (the same one that sets the limiters) is probably what you want.

      Get ready for frowning faces.  You'll probably break all sorts of things if you set this low enough that people actually hit it.

      ETA: This should probably be another thread.

      ![Screen Shot 2015-05-28 at 6.55.47 PM.png](/public/imported_attachments/1/Screen Shot 2015-05-28 at 6.55.47 PM.png)
      ![Screen Shot 2015-05-28 at 6.55.47 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-05-28 at 6.55.47 PM.png_thumb)

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • M
        marcocamza
        last edited by

        @Sifter:

        Since the default LAN rule is used to apply this speed limit, what happens if I want full speed to a transfer on my NAS between two computers on my LAN?  Is the speed limit also imposed on that transfer?  In that scenario, Id want full gigabit speed of the switch, not the imposed 20000 kbits.

        That's exactly what I'm experiancing. With limiters set  and I ping my NAS while doing a speed test the latency is 200+.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Communications between two computers on the same network don't hit the firewall (or the limiter) at all.  Look elsewhere for your throughput issues.

          If you are talking about traffic between two interfaces on pfSense, just add a pass rule on the source interface with a destination of the other interface's INTF net, above the rule that sets the limiter, but with no limiter. ezpz.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • M
            marcocamza
            last edited by

            Thanks it worked.

            Now how do I dedicate a 2mb portion of 10mb for IAX2 Voip on Wan?

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              HFSC Shaping.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • M
                marcocamza
                last edited by

                Thanks maybe you could shed some light on this?

                We currently have an interim wifi link of 10mb but at the end of the month we should have 100mb fibre.

                My setup is 1 wan 7 vlans

                LAN - 10.0.1.0/24 (not used)
                Vlan5  - 10.0.0.0/24 (Devices i.e printers AP switches etc)
                Vlan4  - 172.0.0.0/24 (Ipphones)
                Vlan10 - 10.0.10.0/24 (1st Floor of our company)
                Vlan20 - 10.0.20.0/24 (2nd Floor of our company)
                Vlan30 - 10.0.30.0/24 (Wifi Clients)
                Vlan40 - 10.0.40.0/24 (1st Floor of Another Company)

                Currently limiting per ip on vlan10,20,30 to 2mb up & down.
                Vlan40 is not currently being used.

                So when the 100mb fibre is installed my idea is to limit vlan40 to 10mb for all user within that lan for http etc, and the remaining 90mb bandwidth is for our company.
                From that 90mb I need to allocated 2mb for Voip IAX2 trunk (UDP port 4569) for communication for my internal pbx to service provider.

                help would be greatly appreciated

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Should probably start another thread.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • A
                    albert02
                    last edited by

                    @foxale08:

                    I have attempted to document the process for a simple single lan single wan setup in screenshots. Click apply settings when presented with the option to do so. See if this does what you want.

                    at the post image i would like to ask advice about shaping

                    1. Bandwidth -  what will i put here the ISP gave me or the actual download speed I get when I downloading a file?

                    • ISP Package says up to 5.5mbps
                    • Im getting 650kbps DL/300kbps UL during off-peak and 500kbps during peak hours (@no limit downloading)

                    2. Between (None, Destination, Source) what will be the good to choose if u distribute bandwidth evenly.

                    1 Reply Last reply Reply Quote 0
                    • M
                      mcwtim
                      last edited by

                      Put the bandwidth values you actually can achieve. That being said, complain to your ISP, that is a far cry from 5 Mb. You are not getting what you are paying for.

                      Re; 2. follow all the screenshots, each limiter entry has their own settings for that.

                      1 Reply Last reply Reply Quote 0
                      • E
                        ericnyamu
                        last edited by

                        @foxale08:

                        @blablablablabla:

                        @foxale08:

                        Pfsense has equivalent functionality with limiters.

                        http://doc.pfsense.org/index.php/Traffic_Shaping_Guide#Limiter

                        Limiters assign bandwidth to IP addresses. This means that I can't use the whole pipe if nobody else is using the connection. I originally used PFSense with limiters but everyone got pissed that their internet was only 1/10 the speed all the time. m0n0wall dynamically assigns bandwidth based on use. 90% of the time you get the whole connection, it only slows down when someone else is also using it.

                        I have implemented exactly what your talking about by using two parent limiters (up and down) and creating three child queues under each (the child queues are for each of my three lan subnets. The upload child queues have a 'source address' mask set and the download queues have the 'destination address' mask set.) I set the default pass rules for said subnets to use their appropriate child queues.

                        I do not know if the limiters will behave in the desired fashion if you are assigning traffic directly to a parent limiter, even with the mask set. At the very least, a single child queue, used in the way I am, would work.

                        i donot want to see dumb but where is the set-up script everybody is talking account?

                        1 Reply Last reply Reply Quote 0
                        • K
                          Knight
                          last edited by

                          @ericnyamu:

                          i donot want to see dumb but where is the set-up script everybody is talking account?

                          I think they mean the wizards under Firewall: Traffic Shaper: Wizards…

                          If you want to put in place what foxale08 described you have to do it manually though...

                          Good luck!

                          Nick

                          1 Reply Last reply Reply Quote 0
                          • B
                            boomam
                            last edited by

                            I'm having nothing but issues with this, in any configuration going, either via interface queues or limiter queues. Just doesn't want to work.
                            Unfortunately like most open source projects theres plenty of info on the how and the theory, but little to none on actual implementation.  ???

                            Anyway, per-IP (or set of IP's set as Alias) on a transparent bridge:

                            • Should there be queues on the inside NIC, outside NIC, bridge, or for all three? (in the traffic shaper GUI)

                            • ACK Queue - where? (linked to above question)

                            • At firewall rules, where should the queues be applied? On each interface, on the bridge, floating?

                            • Are we setting the "ackqueue/queue" as a per queue thing without a ack queue specified, or specified?

                            • If specified, which ACK? A global ACK queue, or one specific to each interface? Or one specific to each queue

                            • Source/destination in firewall rules, where do we set the IP alias list? similar to above, on a specific interface or floating?

                            That'd be a good start for me i think…

                            Thanks in advance.

                            1 Reply Last reply Reply Quote 0
                            • G
                              gollo
                              last edited by

                              @boomam:

                              I'm having nothing but issues with this, in any configuration going, either via interface queues or limiter queues. Just doesn't want to work.
                              Unfortunately like most open source projects theres plenty of info on the how and the theory, but little to none on actual implementation.  ???

                              Fortunately for you Pfsense offers commercial support so you can purchase that and then contact them and they can answer your questions AND help you get it implemented.

                              1 Reply Last reply Reply Quote 0
                              • cwagzC
                                cwagz
                                last edited by

                                Just to clarify.

                                I can use one upload and one download limiter to cover my LAN / OPT1 /OPT2 interfaces and it will share the bandwidth evenly between all clients on each subnet, right?

                                Thanks.

                                Netgate 6100 MAX

                                1 Reply Last reply Reply Quote 0
                                • N
                                  n3by
                                  last edited by

                                  On 2.2.3-RELEASE (amd64) it is a bug ???

                                  Limiter enabled and set as in foxale08 posts… accessing from LAN a device on external IP:PORT is NOT WORKING… NAT Reflection probably broke ( NAT setting attached ).

                                  Limiter disabled and accessing from LAN a device on external IP:PORT is WORKING OK.

                                  Untitled.jpg
                                  Untitled.jpg_thumb

                                  1 Reply Last reply Reply Quote 0
                                  • I
                                    ismaelnoble
                                    last edited by

                                    so to clarify, when u enable limiters lan ips are unable to connect to systems located on the WAN subnet through NAT ??? ??? ??? …i have not had this issue but mabe i am interpreting this incorrectly, i have found that limiters do not function (for me) in the 2.2.3 build but it may be a misconfiguration on my part and im still experimenting with it (multi vlan + WPAD-DNS-DHCP + Squid 3 + squidguard + explicit proxy setup).

                                    1 Reply Last reply Reply Quote 0
                                    • cwagzC
                                      cwagz
                                      last edited by

                                      When I had limiters on NAT Reflection stopped working.  I could no longer access internal servers via their external addresses.  Turn off limiters and they would start working again.  Limiters also break Squid Transparent proxy.  There are several bugs in Redmine about this and I believe they are marked as targeted to be fixed in 2.3.

                                      This was a no go for me since I rely on dyndns SRV records to route my kids internal computers to our external facing Minecraft servers.  The solution at the start of this thread works great for sharing bandwidth but it broke too many things for me to be able to continue using it.

                                      Chad

                                      Netgate 6100 MAX

                                      1 Reply Last reply Reply Quote 0
                                      • I
                                        ismaelnoble
                                        last edited by

                                        understood, it is worthwhile that these things are noted. mabe it could be posted up on the limiter doc so no one else is tripped up by this..

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          Limiters are currently completely broken as far as I'm concerned.  Limiters breaking NAT is a known bug.  Don't feel like looking it up.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            doktornotor Banned
                                            last edited by

                                            https://redmine.pfsense.org/issues/4326
                                            https://redmine.pfsense.org/issues/4590

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.